Regulatory Verification

Regulatory verification report for websites.

Every requirement that applies to your website, recorded as met or not met with the evidence and the clause behind it. A point-in-time statement of fact: not a certificate, not legal advice.

  • Not a certificate
  • Not legal advice
  • Point in time
Book an audit call →What the report contains
GDPRePrivacyEAA / WCAGKVKKAI ActDSA
Criteria applied

Eight regimes, three regional packs

The regimes in scope are chosen per engagement from where you operate and whom you serve. Each is cited by article or clause, with the authority, the effective date and the enforcement range.

EU packFive EU regimesGDPR (EU) 2016/679, ePrivacy Directive 2002/58/EC, European Accessibility Act (EU) 2019/882, AI Act (EU) 2024/1689 Art. 50 and Digital Services Act (EU) 2022/2065.
Türkiye packTwo Turkish regimesKVKK, the Personal Data Protection Law No. 6698, together with ETBIS and the E-Commerce Law No. 6563, each cited by article.
Singapore packSingapore PDPAThe Personal Data Protection Act 2012 of Singapore, cited by clause with its authority, effective date and enforcement range.

Accessibility is verified against WCAG 2.2 AA through EN 301 549, the yardstick the European Accessibility Act enforces.

What the report contains

One document, every examination recorded

The report is self-contained and issued in English or Turkish: around one hundred pages for a typical site.

01Requirement registerEvery applicable requirement with its clause and verdict: met, not met, not applicable, outside method or outside scope. No partial verdicts; severity is a finding class: observation, minor or major.
02Evidence indexWhat was fetched, when and from where, with timestamped retrievals and a SHA-256 fingerprint per artefact. A finding without evidence is not issued.
03Document examinationContracts, notices and policies the web surface cannot reach, examined element by element against the provision each element comes from. The document is never stored, only its fingerprint.
04Sampling and systemsRecord extracts and system settings the regulation requires, sampled and observed, with the selection method, the observation status and the access route written down.
05DeclarationsWhat the obligated party declares about itself, recorded separately from what was examined, with an outcome per declaration. Refusals are recorded as refusals.
06Verification recordA public page, reached by link or QR code, confirms the report id, issue date, issuer and any withdrawal. It shows no findings and needs no account.
How it is done

Scoped, examined, reviewed, issued

  1. 01
    Scope, price and authorisationAfter one call you receive a written scope and a written price. You confirm the site, the regime packs and your written authorisation; nothing is fetched before that.
  2. 02
    ExaminationAutomatable checks run against the live site; content is read; documents, samples and systems you share are examined element by element.
  3. 03
    Assessor reviewEvery verdict is entered by the assessor. AI drafts where it helps; it never decides a requirement.
  4. 04
    Issue and verifyThe report is issued as a numbered revision with a verification page. A later revision supersedes it and says so.
What this report is not

A statement of fact, not a certificate

The five boundaries are printed in the report and on this page in the same words. The sixth card states how every examination is limited.

01Not a certificateNot a certificate of conformity; the declaration and the legal responsibility stay with the obligated party.
02Not accreditedNot an accredited inspection or certification service. STRASYS is not an accredited certification or inspection body.
03Not legal adviceNot legal advice; it does not replace counsel in the jurisdictions where you operate.
04Point in timePoint in time: it describes the site as observed during the assessment period.
05Single assessorExamined and released by a single assessor; no independent review step is claimed.
06No active security testingNo active security testing is performed. Automatable checks run against the publicly reachable site during a recorded assessment period.
Questions

What buyers and their counsel ask

What the report is

Is this a certificate?

No. It is a third-party verification report: a statement of what was examined and whether each requirement was met. It is not a certificate of conformity and STRASYS is not an accredited certification or inspection body.

Is it legal advice?

No. The report records facts against published requirements. What to do about a finding in your jurisdiction is a question for your counsel; the report gives them the evidence.

Who remains responsible for conformity?

You do, as the obligated party. The declaration of conformity and the legal responsibility stay with you; the report records what was examined and whether each requirement was met during the assessment period.

Method and evidence

Which findings concern the law, and which do not?

Every criterion sits in exactly one register. Legal: a statute or directly applicable instrument such as GDPR, the EAA or KVKK. Standard: published specifications from schema.org, the IETF, Google or OWASP, reported as information. Method: the STRASYS checklist, labelled so it is never mistaken for a legal requirement.

Who does the work, and what does AI do?

The founder of STRASYS, as a single assessor; the report says so and claims no independent review step. AI drafts where it helps, but every verdict is entered by the assessor.

How does someone check that a report is genuine?

Every issued report carries a verification link and a QR code. The public page confirms the report id, issue date and issuer, and shows whether the report has been withdrawn. It shows no findings.

Price and timing

How much does it cost?

It is quoted in writing. The price depends on the size of the site, the regime packs and whether documents, samples and systems are in scope. You receive a written scope and a written price after one call.

What if the site changes after the report?

The report describes the site as observed during the assessment period. A later revision supersedes it and says so, and a withdrawn report shows as withdrawn on its verification page.

Should we start with the Digital Audit instead?

The Digital Audit is $199, one-time: 150+ points across 16 areas and a 30+ page report, credited toward a build. Not sure which fits? Write to us with your website address and where you operate, and we will tell you which report fits.

Scoped per site and pack, quoted in writing

Book a call to confirm the site and the regime packs, or write to care@strasysglobal.com.

Book a verification callDigital AuditWrite to us
Where to start

Start with a product, or with a conversation.

Install a product today, set it up together, scope custom software or start with an audit.

01Software solutions
Software solutions
Six products. Custom software.
Management Suite: six products, 30-day trial, list prices.
Custom Software & AI: built on your process. Written price.
  • Monthly or annual plans
  • Seat plans from 10 seats
  • iPhone, Android, Windows, web
  • No card, no call, cancel any time
List prices online
See pricing →
02For companies
Set it up with us
Configured together, ready for the first quarter.
Sites, roles, users and data import configured with you after a free 30-minute call.
  • Free 30-minute call first
  • One working session
  • First quarter entered together
  • Written quote before the session
30 min · free call
Book a software call →
03Designed end to end
Custom Software & AI
Built on your own process, by one person, A to Z.
Thirty minutes is usually enough to understand the need. The rest is designed and built by the founder.
  • One scoping call
  • Written scope and price
  • Same standard as the six products
  • Handed over, no retainer
60 min · written scope and price
Scope custom software →
04For your web presence
Digital Audit & Regulatory Verification
Know exactly where your website stands.
A 150+ point audit with a 30+ page report, or a regulatory verification report with evidence for every finding.
  • Digital audit, one-time
  • Verification: met or not met, with evidence
  • Public verification page
  • Not a certificate, not legal advice
30 min · free call
Book an audit call →
None of these fit?

Write to us and we will point you to the right path.

care@strasysglobal.com